/mandos/trunk : revision 518.2.1

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import hashlib

66

import binascii

67

import tempfile

67

68

69

import dbus

69

70

import dbus.service

74

75

import ctypes.util

75

76

import xml.dom.minidom

76

77

import inspect

77

import Crypto.Cipher.AES

78

import GnuPGInterface

78

79

80

try:

80

81

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

86

87

88

89

version = "1.4.1"

90

stored_state_path = "/var/lib/mandos/clients.pickle"

89

91

90

92

logger = logging.getLogger()

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

93

syslogger = (logging.handlers.SysLogHandler

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

address = str("/dev/log")))

96

syslogger.setFormatter(logging.Formatter

97

('Mandos [%(process)d]: %(levelname)s:'

98

' %(message)s'))

99

logger.addHandler(syslogger)

100

101

console = logging.StreamHandler()

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

104

' %(levelname)s:'

105

' %(message)s'))

106

logger.addHandler(console)

96

97

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

101

except (OSError, AttributeError):

102

def if_nametoindex(interface):

103

"Get an interface index the hard way, i.e. using fcntl()"

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

with contextlib.closing(socket.socket()) as s:

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

111

return interface_index

112

113

114

def initlogger(level=logging.WARNING):

115

"""init logger and add loglevel"""

116

117

syslogger.setFormatter(logging.Formatter

118

('Mandos [%(process)d]: %(levelname)s:'

119

' %(message)s'))

120

logger.addHandler(syslogger)

121

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class CryptoError(Exception):

132

pass

133

134

135

class Crypto(object):

136

"""A simple class for OpenPGP symmetric encryption & decryption"""

137

def __init__(self):

138

self.gnupg = GnuPGInterface.GnuPG()

139

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

140

self.gnupg = GnuPGInterface.GnuPG()

141

self.gnupg.options.meta_interactive = False

142

self.gnupg.options.homedir = self.tempdir

143

self.gnupg.options.extra_args.extend(['--force-mdc',

144

'--quiet'])

145

146

def __enter__(self):

147

return self

148

149

def __exit__ (self, exc_type, exc_value, traceback):

150

self._cleanup()

151

return False

152

153

def __del__(self):

154

self._cleanup()

155

156

def _cleanup(self):

157

if self.tempdir is not None:

158

# Delete contents of tempdir

159

for root, dirs, files in os.walk(self.tempdir,

160

topdown = False):

161

for filename in files:

162

os.remove(os.path.join(root, filename))

163

for dirname in dirs:

164

os.rmdir(os.path.join(root, dirname))

165

# Remove tempdir

166

os.rmdir(self.tempdir)

167

self.tempdir = None

168

169

def password_encode(self, password):

170

# Passphrase can not be empty and can not contain newlines or

171

# NUL bytes. So we prefix it and hex encode it.

172

return b"mandos" + binascii.hexlify(password)

173

174

def encrypt(self, data, password):

175

self.gnupg.passphrase = self.password_encode(password)

176

with open(os.devnull) as devnull:

177

try:

178

proc = self.gnupg.run(['--symmetric'],

179

create_fhs=['stdin', 'stdout'],

180

attach_fhs={'stderr': devnull})

181

with contextlib.closing(proc.handles['stdin']) as f:

182

f.write(data)

183

with contextlib.closing(proc.handles['stdout']) as f:

184

ciphertext = f.read()

185

proc.wait()

186

except IOError as e:

187

raise CryptoError(e)

188

self.gnupg.passphrase = None

189

return ciphertext

190

191

def decrypt(self, data, password):

192

self.gnupg.passphrase = self.password_encode(password)

193

with open(os.devnull) as devnull:

194

try:

195

proc = self.gnupg.run(['--decrypt'],

196

create_fhs=['stdin', 'stdout'],

197

attach_fhs={'stderr': devnull})

198

with contextlib.closing(proc.handles['stdin'] ) as f:

199

f.write(data)

200

with contextlib.closing(proc.handles['stdout']) as f:

201

decrypted_plaintext = f.read()

202

proc.wait()

203

except IOError as e:

204

raise CryptoError(e)

205

self.gnupg.passphrase = None

206

return decrypted_plaintext

207

107

208

108

209

109

210

class AvahiError(Exception):

226

327

try:

227

328

self.group.Free()

228

329

except (dbus.exceptions.UnknownMethodException,

229

dbus.exceptions.DBusException) as e:

330

dbus.exceptions.DBusException):

230

331

pass

231

332

self.group = None

232

333

self.remove()

310

411

interval: datetime.timedelta(); How often to start a new checker

311

412

last_approval_request: datetime.datetime(); (UTC) or None

312

413

last_checked_ok: datetime.datetime(); (UTC) or None

414

313

415

last_checker_status: integer between 0 and 255 reflecting exit

314

status of last checker. -1 reflect crashed

416

status of last checker. -1 reflects crashed

315

417

checker, or None.

316

418

last_enabled: datetime.datetime(); (UTC)

317

419

name: string; from the config file, used in log messages and

398

500

self.changedstate = (multiprocessing_manager

399

501

.Condition(multiprocessing_manager

400

502

.Lock()))

401

self.client_structure = [attr for attr

402

in self.__dict__.iterkeys()

503

self.client_structure = [attr for attr in

504

self.__dict__.iterkeys()

403

505

if not attr.startswith("_")]

404

506

self.client_structure.append("client_structure")

405

406

507

407

508

for name, t in inspect.getmembers(type(self),

408

509

lambda obj:

409

510

isinstance(obj,

449

550

450

551

def __del__(self):

451

552

self.disable()

452

553

453

554

def init_checker(self):

454

555

# Schedule a new checker to be started an 'interval' from now,

455

556

# and every interval from then on.

462

563

self.disable))

463

564

# Also start a new checker *right now*.

464

565

self.start_checker()

465

466

566

467

567

def checker_callback(self, pid, condition, command):

468

568

"""The checker has completed, so take appropriate actions."""

469

569

self.checker_callback_tag = None

595

695

raise

596

696

self.checker = None

597

697

598

# Encrypts a client secret and stores it in a varible

599

# encrypted_secret

600

def encrypt_secret(self, key):

601

# Encryption-key need to be of a specific size, so we hash

602

# supplied key

603

hasheng = hashlib.sha256()

604

hasheng.update(key)

605

encryptionkey = hasheng.digest()

606

607

# Create validation hash so we know at decryption if it was

608

# sucessful

609

hasheng = hashlib.sha256()

610

hasheng.update(self.secret)

611

validationhash = hasheng.digest()

612

613

# Encrypt secret

614

iv = os.urandom(Crypto.Cipher.AES.block_size)

615

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

616

Crypto.Cipher.AES.MODE_CFB, iv)

617

ciphertext = ciphereng.encrypt(validationhash+self.secret)

618

self.encrypted_secret = (ciphertext, iv)

619

620

# Decrypt a encrypted client secret

621

def decrypt_secret(self, key):

622

# Decryption-key need to be of a specific size, so we hash

623

# supplied key

624

hasheng = hashlib.sha256()

625

hasheng.update(key)

626

encryptionkey = hasheng.digest()

627

628

# Decrypt encrypted secret

629

ciphertext, iv = self.encrypted_secret

630

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

631

Crypto.Cipher.AES.MODE_CFB, iv)

632

plain = ciphereng.decrypt(ciphertext)

633

634

# Validate decrypted secret to know if it was succesful

635

hasheng = hashlib.sha256()

636

validationhash = plain[:hasheng.digest_size]

637

secret = plain[hasheng.digest_size:]

638

hasheng.update(secret)

639

640

# If validation fails, we use key as new secret. Otherwise, we

641

# use the decrypted secret

642

if hasheng.digest() == validationhash:

643

self.secret = secret

644

else:

645

self.secret = key

646

del self.encrypted_secret

647

648

698

649

699

def dbus_service_property(dbus_interface, signature="v",

650

700

access="readwrite", byte_arrays=False):

768

818

769

819

Note: Will not include properties with access="write".

770

820

"""

771

all = {}

821

properties = {}

772

822

for name, prop in self._get_all_dbus_properties():

773

823

if (interface_name

774

824

and interface_name != prop._dbus_interface):

779

829

continue

780

830

value = prop()

781

831

if not hasattr(value, "variant_level"):

782

all[name] = value

832

properties[name] = value

783

833

continue

784

all[name] = type(value)(value, variant_level=

785

value.variant_level+1)

786

return dbus.Dictionary(all, signature="sv")

834

properties[name] = type(value)(value, variant_level=

835

value.variant_level+1)

836

return dbus.Dictionary(properties, signature="sv")

787

837

788

838

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

789

839

out_signature="s",

840

890

return dbus.String(dt.isoformat(),

841

891

variant_level=variant_level)

842

892

893

843

894

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

844

895

.__metaclass__):

845

896

"""Applied to an empty subclass of a D-Bus object, this metaclass

937

988

attribute.func_closure)))

938

989

return type.__new__(mcs, name, bases, attr)

939

990

991

940

992

class ClientDBus(Client, DBusObjectWithProperties):

941

993

"""A Client class using D-Bus

942

994

952

1004

953

1005

def __init__(self, bus = None, *args, **kwargs):

954

1006

self.bus = bus

1007

Client.__init__(self, *args, **kwargs)

1008

955

1009

self._approvals_pending = 0

956

Client.__init__(self, *args, **kwargs)

957

self.add_to_dbus()

958

959

def add_to_dbus(self):

960

1010

# Only now, when this client is initialized, can it show up on

961

1011

# the D-Bus

962

1012

client_object_name = unicode(self.name).translate(

972

1022

variant_level=1):

973

1023

""" Modify a variable so that it's a property which announces

974

1024

its changes to DBus.

975

1025

976

1026

transform_fun: Function that takes a value and a variant_level

977

1027

and transforms it to a D-Bus type.

978

1028

dbus_name: D-Bus name of the variable

1132

1182

"D-Bus signal"

1133

1183

return self.need_approval()

1134

1184

1185

# NeRwequest - signal

1186

@dbus.service.signal(_interface, signature="s")

1187

def NewRequest(self, ip):

1188

"""D-Bus signal

1189

Is sent after a client request a password.

1190

"""

1191

pass

1192

1135

1193

## Methods

1136

1194

1137

1195

# Approve - method

1366

1424

return super(ProxyClient, self).__setattr__(name, value)

1367

1425

self._pipe.send(('setattr', name, value))

1368

1426

1427

1369

1428

class ClientDBusTransitional(ClientDBus):

1370

1429

__metaclass__ = AlternateDBusNamesMetaclass

1371

1430

1431

1372

1432

class ClientHandler(socketserver.BaseRequestHandler, object):

1373

1433

"""A class to handle client connections.

1374

1434

1435

1495

logger.warning("Bad certificate: %s", error)

1436

1496

return

1437

1497

logger.debug("Fingerprint: %s", fpr)

1498

if self.server.use_dbus:

1499

# Emit D-Bus signal

1500

client.NewRequest(str(self.client_address))

1438

1501

1439

1502

try:

1440

1503

client = ProxyClient(child_pipe, fpr,

1584

1647

# Convert the buffer to a Python bytestring

1585

1648

fpr = ctypes.string_at(buf, buf_len.value)

1586

1649

# Convert the bytestring to hexadecimal notation

1587

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1650

hex_fpr = binascii.hexlify(fpr).upper()

1588

1651

return hex_fpr

1589

1652

1590

1653

1847

1910

return timevalue

1848

1911

1849

1912

1850

def if_nametoindex(interface):

1851

"""Call the C function if_nametoindex(), or equivalent

1852

1853

Note: This function cannot accept a unicode string."""

1854

global if_nametoindex

1855

try:

1856

if_nametoindex = (ctypes.cdll.LoadLibrary

1857

(ctypes.util.find_library("c"))

1858

.if_nametoindex)

1859

except (OSError, AttributeError):

1860

logger.warning("Doing if_nametoindex the hard way")

1861

def if_nametoindex(interface):

1862

"Get an interface index the hard way, i.e. using fcntl()"

1863

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1864

with contextlib.closing(socket.socket()) as s:

1865

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1866

struct.pack(str("16s16x"),

1867

interface))

1868

interface_index = struct.unpack(str("I"),

1869

ifreq[16:20])[0]

1870

return interface_index

1871

return if_nametoindex(interface)

1872

1873

1874

1913

def daemon(nochdir = False, noclose = False):

1875

1914

"""See daemon(3). Standard BSD Unix function.

1876

1915

1932

1971

parser.add_argument("--no-ipv6", action="store_false",

1933

1972

dest="use_ipv6", help="Do not use IPv6")

1934

1973

parser.add_argument("--no-restore", action="store_false",

1935

dest="restore",

1936

help="Do not restore stored state",

1937

default=True)

1938

1974

dest="restore", help="Do not restore stored"

1975

" state", default=True)

1976

1939

1977

options = parser.parse_args()

1940

1978

1941

1979

if options.check:

1995

2033

use_dbus = server_settings["use_dbus"]

1996

2034

use_ipv6 = server_settings["use_ipv6"]

1997

2035

2036

if debug:

2037

initlogger(logging.DEBUG)

2038

else:

2039

if not debuglevel:

2040

initlogger()

2041

else:

2042

level = getattr(logging, debuglevel.upper())

2043

initlogger(level)

2044

1998

2045

if server_settings["servicename"] != "Mandos":

1999

2046

syslogger.setFormatter(logging.Formatter

2000

2047

('Mandos (%s) [%%(process)d]:'

2054

2101

if error[0] != errno.EPERM:

2055

2102

raise error

2056

2103

2057

if not debug and not debuglevel:

2058

logger.setLevel(logging.WARNING)

2059

if debuglevel:

2060

level = getattr(logging, debuglevel.upper())

2061

logger.setLevel(level)

2062

2063

2104

if debug:

2064

logger.setLevel(logging.DEBUG)

2065

2105

# Enable all possible GnuTLS debugging

2066

2106

2067

2107

# "Use a log level over 10 to enable all debugging options."

2136

2176

# with exceptions for any special settings as defined above

2137

2177

client_settings = dict((clientname,

2138

2178

dict((setting,

2139

(value if

2140

setting not in special_settings

2179

(value

2180

if setting not in special_settings

2141

2181

else special_settings[setting]

2142

2182

(clientname)))

2143

for setting, value

2144

in client_config.items(clientname)))

2183

for setting, value in

2184

client_config.items(clientname)))

2145

2185

for clientname in client_config.sections())

2146

2186

2147

2187

old_client_settings = {}

2148

2188

clients_data = []

2149

2150

# Get client data and settings from last running state.

2189

2190

# Get client data and settings from last running state.

2151

2191

if server_settings["restore"]:

2152

2192

try:

2153

2193

with open(stored_state_path, "rb") as stored_state:

2154

clients_data, old_client_settings = (

2155

pickle.load(stored_state))

2194

clients_data, old_client_settings = (pickle.load

2195

(stored_state))

2156

2196

os.remove(stored_state_path)

2157

2197

except IOError as e:

2158

logger.warning("Could not load persistant state: {0}"

2198

logger.warning("Could not load persistent state: {0}"

2159

2199

.format(e))

2160

2200

if e.errno != errno.ENOENT:

2161

2201

raise

2162

2163

for client in clients_data:

2164

client_name = client["name"]

2165

2166

# Decide which value to use after restoring saved state.

2167

# We have three different values: Old config file,

2168

# new config file, and saved state.

2169

# New config value takes precedence if it differs from old

2170

# config value, otherwise use saved state.

2171

for name, value in client_settings[client_name].items():

2202

2203

with Crypto() as crypt:

2204

for client in clients_data:

2205

client_name = client["name"]

2206

2207

# Decide which value to use after restoring saved state.

2208

# We have three different values: Old config file,

2209

# new config file, and saved state.

2210

# New config value takes precedence if it differs from old

2211

# config value, otherwise use saved state.

2212

for name, value in client_settings[client_name].items():

2213

try:

2214

# For each value in new config, check if it

2215

# differs from the old config value (Except for

2216

# the "secret" attribute)

2217

if (name != "secret" and

2218

value != old_client_settings[client_name]

2219

[name]):

2220

setattr(client, name, value)

2221

except KeyError:

2222

pass

2223

2224

# Clients who has passed its expire date can still be

2225

# enabled if its last checker was sucessful. Clients

2226

# whose checker failed before we stored its state is

2227

# assumed to have failed all checkers during downtime.

2228

if client["enabled"] and client["last_checked_ok"]:

2229

if ((datetime.datetime.utcnow()

2230

- client["last_checked_ok"])

2231

> client["interval"]):

2232

if client["last_checker_status"] != 0:

2233

client["enabled"] = False

2234

else:

2235

client["expires"] = (datetime.datetime

2236

.utcnow()

2237

+ client["timeout"])

2238

2239

client["changedstate"] = (multiprocessing_manager

2240

.Condition

2241

(multiprocessing_manager

2242

.Lock()))

2243

if use_dbus:

2244

new_client = (ClientDBusTransitional.__new__

2245

(ClientDBusTransitional))

2246

tcp_server.clients[client_name] = new_client

2247

new_client.bus = bus

2248

for name, value in client.iteritems():

2249

setattr(new_client, name, value)

2250

client_object_name = unicode(client_name).translate(

2251

{ord("."): ord("_"),

2252

ord("-"): ord("_")})

2253

new_client.dbus_object_path = (dbus.ObjectPath

2254

("/clients/"

2255

+ client_object_name))

2256

DBusObjectWithProperties.__init__(new_client,

2257

new_client.bus,

2258

new_client

2259

.dbus_object_path)

2260

else:

2261

tcp_server.clients[client_name] = (Client.__new__

2262

(Client))

2263

for name, value in client.iteritems():

2264

setattr(tcp_server.clients[client_name],

2265

name, value)

2266

2172

2267

try:

2173

# For each value in new config, check if it differs

2174

# from the old config value (Except for the "secret"

2175

# attribute)

2176

if (name != "secret" and

2177

value != old_client_settings[client_name][name]):

2178

setattr(client, name, value)

2179

except KeyError:

2180

pass

2181

2182

# Clients who has passed its expire date, can still be enabled

2183

# if its last checker was sucessful. Clients who checkers

2184

# failed before we stored it state is asumed to had failed

2185

# checker during downtime.

2186

if client["enabled"] and client["last_checked_ok"]:

2187

if ((datetime.datetime.utcnow()

2188

- client["last_checked_ok"]) > client["interval"]):

2189

if client["last_checker_status"] != 0:

2190

client["enabled"] = False

2191

else:

2192

client["expires"] = (datetime.datetime.utcnow()

2193

+ client["timeout"])

2194

2195

client["changedstate"] = (multiprocessing_manager

2196

.Condition(multiprocessing_manager

2197

.Lock()))

2198

if use_dbus:

2199

new_client = ClientDBusTransitional.__new__(

2200

ClientDBusTransitional)

2201

tcp_server.clients[client_name] = new_client

2202

new_client.bus = bus

2203

for name, value in client.iteritems():

2204

setattr(new_client, name, value)

2205

new_client._approvals_pending = 0

2206

new_client.add_to_dbus()

2207

else:

2208

tcp_server.clients[client_name] = Client.__new__(Client)

2209

for name, value in client.iteritems():

2210

setattr(tcp_server.clients[client_name], name, value)

2211

2212

tcp_server.clients[client_name].decrypt_secret(

2213

client_settings[client_name]["secret"])

2214

2268

tcp_server.clients[client_name].secret = (

2269

crypt.decrypt(tcp_server.clients[client_name]

2270

.encrypted_secret,

2271

client_settings[client_name]

2272

["secret"]))

2273

except CryptoError:

2274

# If decryption fails, we use secret from new settings

2275

tcp_server.clients[client_name].secret = (

2276

client_settings[client_name]["secret"])

2277

2215

2278

# Create/remove clients based on new changes made to config

2216

2279

for clientname in set(old_client_settings) - set(client_settings):

2217

2280

del tcp_server.clients[clientname]

2218

2281

for clientname in set(client_settings) - set(old_client_settings):

2219

tcp_server.clients[clientname] = client_class(name

2220

= clientname,

2221

config =

2222

client_settings

2223

[clientname])

2282

tcp_server.clients[clientname] = (client_class(name

2283

= clientname,

2284

config =

2285

client_settings

2286

[clientname]))

2224

2287

2225

2288

if not tcp_server.clients:

2226

2289

logger.warning("No clients defined")

2309

2372

multiprocessing.active_children()

2310

2373

if not (tcp_server.clients or client_settings):

2311

2374

return

2312

2375

2313

2376

# Store client before exiting. Secrets are encrypted with key

2314

2377

# based on what config file has. If config file is

2315

2378

# removed/edited, old secret will thus be unrecovable.

2316

2379

clients = []

2317

for client in tcp_server.clients.itervalues():

2318

client.encrypt_secret(

2319

client_settings[client.name]["secret"])

2320

2321

client_dict = {}

2322

2323

# A list of attributes that will not be stored when

2324

# shutting down.

2325

exclude = set(("bus", "changedstate", "secret"))

2326

for name, typ in inspect.getmembers(dbus.service.Object):

2327

exclude.add(name)

2328

2329

client_dict["encrypted_secret"] = client.encrypted_secret

2330

for attr in client.client_structure:

2331

if attr not in exclude:

2332

client_dict[attr] = getattr(client, attr)

2333

2334

clients.append(client_dict)

2335

del client_settings[client.name]["secret"]

2336

2380

with Crypto() as crypt:

2381

for client in tcp_server.clients.itervalues():

2382

key = client_settings[client.name]["secret"]

2383

client.encrypted_secret = crypt.encrypt(client.secret,

2384

key)

2385

client_dict = {}

2386

2387

# A list of attributes that will not be stored when

2388

# shutting down.

2389

exclude = set(("bus", "changedstate", "secret"))

2390

for name, typ in (inspect.getmembers

2391

(dbus.service.Object)):

2392

exclude.add(name)

2393

2394

client_dict["encrypted_secret"] = (client

2395

.encrypted_secret)

2396

for attr in client.client_structure:

2397

if attr not in exclude:

2398

client_dict[attr] = getattr(client, attr)

2399

2400

clients.append(client_dict)

2401

del client_settings[client.name]["secret"]

2402

2337

2403

try:

2338

2404

with os.fdopen(os.open(stored_state_path,

2339

2405

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2340

stat.S_IRUSR | stat.S_IWUSR),

2341

"wb") as stored_state:

2406

0600), "wb") as stored_state:

2342

2407

pickle.dump((clients, client_settings), stored_state)

2343

except IOError as e:

2344

logger.warning("Could not save persistant state: {0}"

2408

except (IOError, OSError) as e:

2409

logger.warning("Could not save persistent state: {0}"

2345

2410

.format(e))

2346

if e.errno != errno.ENOENT:

2411

if e.errno not in (errno.ENOENT, errno.EACCES):

2347

2412

raise

2348

2413

2349

2414

# Delete all clients, and settings from config

2350

2415

while tcp_server.clients:

2351

2416

name, client = tcp_server.clients.popitem()

2369

2434

# Need to initiate checking of clients

2370

2435

if client.enabled:

2371

2436

client.init_checker()

2372

2373

2437

2374

2438

tcp_server.enable()

2375

2439

tcp_server.server_activate()